Senior Cyber Incident Response Lead

Google Inc.; New York (NY); On-site; USD 138,000 - 200,000; Full time

Job summary

Google Cloud's Mandiant unit seeks a Senior Incident Response Consultant to lead complex investigations, threat hunting, and forensic analysis for enterprise clients in the US. The role combines deep technical work with client-facing engagement and mentoring of junior team members.

You will work on end-to-end incident response, containment and remediation, and deliver detailed reports to technical staff and executives. Travel up to 30% is expected.

Qualifications

• Bachelor's degree in Computer Science, Information Systems, Cybersecurity, related technical field, or equivalent practical experience.
• 5 years of experience working end to end incident response investigations, analysis, or containment actions.
• 5 years of experience with network and log forensic analysis, malware triage analysis, and disk and memory forensics in one or more operating systems (e.g., Linux).
• Ability to travel up to 30% of the time.

Responsibilities

• Collaborate with internal and customer teams to investigate and contain incidents.
• Recognize and codify attacker Tools, Tactics, and Procedures (TTPs) and Indicators of Compromise (IOCs) that can be applied to current and future investigations.
• Conduct host forensics, network forensics, log analysis, and malware triage in support of incident response investigations.
• Develop and present comprehensive and accurate reports and presentations for both technical and executive audiences.

Skills

Incident response experience

Forensic analysis

Mentoring junior team

Travel willingness

Education

Bachelor's degree (CS/related)

Job description

Google Cloud's Mandiant unit seeks a Senior Incident Response Consultant to lead complex investigations, threat hunting, and forensic analysis for enterprise clients in the US. The role combines deep technical work with client-facing engagement and mentoring of junior team members.

You will work on end-to-end incident response, containment and remediation, and deliver detailed reports to technical staff and executives. Travel up to 30% is expected.